10 min read
Anthropic Found a Fourth Claude Breach and Called In METR
Anthropic disclosed a fourth Claude incident on Sept 9 and brought in independent evaluator METR to check its…
The Lab · Written in the open · Tagged Security
Lab.
Working notes from the studio. The tools I build, the workflows I keep, the mistakes I paid for.
12 entries · latest 2026-09-11
Latest entry
What Anthropic's September Threat Report Actually Found
Anthropic's September threat report details nine months of real Claude misuse, from drone swarms to stolen API keys used as loot.
Read the entry
TLDR
This entry in one minute
- Anthropic published its September 2026 threat intelligence report on September 10, covering nine months of Claude misuse across seven harm areas from December 2025 to August 2026
- DeepSeek quietly relayed 12.1 million user exchanges to Claude Opus in a 14 day window in July 2026, exposing live credentials from a Russian government database
- Anthropic disrupted five bioweapons-adjacent research attempts and one freelance-built autonomous kamikaze drone swarm, then banned every account involved
All entries · Security
9 min read
The Security Review Every RAXXO Tool Passes Before Launch
Every RAXXO tool, free or paid, passes the same five-check security review before launch. Here is the checklist…
15 min read
OpenAI Made Astra Harder to Watch and Shipped It
GPT-6 Astra is the first model OpenAI rates Critical for cyber. It also monitors worse than the model…
9 min read
Claude's Share Feature Let Private Chats Reach Google Search
A missing noindex tag let shared Claude conversations and Artifacts turn up in Google and Bing search results…
9 min read
Claude Security: Anthropic's New Vulnerability Scanner
Anthropic shipped Claude Security in beta, a multi-agent scanner that turns vulnerability findings into reviewed patches inside Claude…
8 min read
Claude Security Update: Scans, Webhooks, 6 Partners
Claude Security left its launch behind with scheduled scans, directory targeting, and CSV or Markdown exports.
8 min read
Claude Security Goes Public Beta: Repo Scanning, Vuln Explainer, Patch Guidance
Claude Security entered public beta on May 2026, scanning repos and explaining vulnerabilities for Claude Enterprise customers only
8 min read
Shopify April 2026 Breaking Changes: What Developers Must Fix
Shopify now requires expiring offline access tokens for all new public apps as of April 1
8 min read
GitHub Got Hit With 475 Malicious PRs in 26 Hours
Attacker opened 475+ malicious PRs across GitHub in 26 hours using AI-generated payloads
10 min read
Anthropic Just Gave 12 Companies Their Most Dangerous AI Model. On Purpose.
Project Glasswing uses Claude Mythos Preview to find zero-days in critical infrastructure. 12 partners, 100M USD in credits,…
11 min read
How I Built an Anti-Cheat System for a CSS Game
Three versions of anti-cheat for a CSS centering game with 3,000+ attempts. HMAC tokens, pattern analysis, and HTTP…